About ZeroDay Labs
Security testing shaped by real bug hunting.
ZeroDay Labs is an independent security practice offering on-demand manual penetration testing for web applications and APIs.
The approach
Find out what an application assumes, then test whether that assumption holds.
That loop comes from bug bounty and vulnerability disclosure work, where only confirmed, reproducible issues count. ZeroDay Labs applies the same standard to authorized engagements.
Principles
How every engagement is handled.
- 01
Permission first.
Testing happens only with written authorization, and only within the agreed scope.
- 02
Prove the minimum.
A report needs enough evidence to act on. Testing stops there, and data that was never needed is not kept.
- 03
Report what is real.
Findings are confirmed by hand before they reach you. Severity reflects actual impact on your business.
- 04
Keep it confidential.
Your name, systems and results stay private unless you give written permission.
- 05
Credit the work.
Techniques from other researchers are linked to them. Reproducing a CVE is not the same as finding it.
Who tests
Led by a working researcher.
Testing is led by Muhammad Waseem, a security researcher active in bug bounty and vulnerability disclosure programs since 2022.
Bugcrowd figures as of 9 Nov 2026. See the full track record.
Find it before someone else does.
Tell ZeroDay Labs what you need tested. You will get a clear scope and a written quote before any work begins.
Request a pentest